Skip to main content

Wireshark Multiple Vulnerabilities

Last Update Date: 21 May 2013 10:14 Release Date: 21 May 2013 4267 Views

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

TYPE: Security Software & Appliance

Multiple vulnerabilities have been identified in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service).

 

  1. An error in the RELOAD dissector (dissectors/packet-reload.c) can be exploited to trigger infinite loops and consume CPU resources via specially crafted packets.
    This is related to vulnerability in: SA13030802
  2. An error in the GTPv2 dissector (dissectors/packet-gtpv2.c) can be exploited to cause a crash via specially crafted packets.
  3. An error in the ASN.1 BER dissector can be exploited to cause a crash via specially crafted packets. This vulnerability is reported in versions prior to 1.6.15 and 1.8.7.
  4. An error in the PPP CCP dissector (dissectors/packet-ppp.c) can be exploited to cause a crash via specially crafted packets.
  5. An error in the DCP ETSI dissector (dissectors/packet-dcp-etsi.c) can be exploited to cause a crash via specially crafted packets.
  6. An error in the MPEG DSM-CC dissector (dissectors/packet-mpeg-dsmcc.c) can be exploited to cause a crash via specially crafted packets.
  7. An error in the Websocket dissector (dissectors/packet-websocket.c) can be exploited to cause a crash via specially crafted packets.
  8. An error in the MySQL dissector (dissectors/packet-mysql.c) can be exploited to trigger infinite loops and consume CPU resources via specially crafted packets.
  9. An error in the ETCH dissector (dissectors/packet-etch.c) can be exploited to trigger a large loop and consume CPU resources via specially crafted packets.

The vulnerabilities #1, #2, and #4 through #9 are reported in versions prior to 1.8.7.


Impact

  • Denial of Service

System / Technologies affected

  • Wireshark 1.x

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

  • Update to version 1.6.15 or 1.8.7.

Vulnerability Identifier


Source


Related Link